Bug 2184751 (CVE-2023-4503)

Summary:	CVE-2023-4503 eap-galleon: custom provisioning creates unsecured http-invoker
Product:	[Other] Security Response	Reporter:	Chess Hazlett <chazlett>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	asoldano, bbaranow, bmaxwell, brian.stansberry, bspyrkos, cdewolf, chazlett, darran.lofthouse, dkreling, dosoudil, fjuma, ivassile, iweiss, lgao, mosmerov, msochure, mstefank, msvehla, nwallace, pjindal, pmackay, rstancel, security-response-team, smaestri, tom.jenkinson
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-07-01 16:56:28 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2144587

Description Chess Hazlett 2023-04-05 15:33:27 UTC

When using Galleon to provision custom EAP or EAP-XP servers, the servers were created unsecured. An attacker could then use this issue to access remote HTTP services available from the server.

Comment 7 errata-xmlrpc 2023-12-04 17:56:39 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9

Via RHSA-2023:7639 https://access.redhat.com/errata/RHSA-2023:7639

Comment 8 errata-xmlrpc 2023-12-04 17:57:16 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2023:7637 https://access.redhat.com/errata/RHSA-2023:7637

Comment 9 errata-xmlrpc 2023-12-04 17:59:09 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2023:7638 https://access.redhat.com/errata/RHSA-2023:7638

Comment 10 errata-xmlrpc 2023-12-04 18:02:19 UTC

This issue has been addressed in the following products:

  EAP 7.4.14

Via RHSA-2023:7641 https://access.redhat.com/errata/RHSA-2023:7641

Comment 11 errata-xmlrpc 2024-06-04 10:59:01 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2024:3583 https://access.redhat.com/errata/RHSA-2024:3583

Comment 12 errata-xmlrpc 2024-06-04 11:00:28 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9

Via RHSA-2024:3581 https://access.redhat.com/errata/RHSA-2024:3581

Comment 13 errata-xmlrpc 2024-06-04 11:03:40 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Via RHSA-2024:3580 https://access.redhat.com/errata/RHSA-2024:3580

Comment 15 errata-xmlrpc 2025-10-23 22:34:12 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7

Via RHSA-2023:7641 https://access.redhat.com/errata/RHSA-2023:7641